VolumeSource: OCI Artifact and/or Image

[sallyom]

Enhancement Description

• One-line enhancement description (can be used as a release note): VolumeSource: OCI Artifact or OCI Image
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4639-oci-volume-source
• Discussion Link:
• Primary contact (assignee): sgrunert@redhat.com, somalley@redhat.com
• Responsible SIGs: sig-node, sig-storage
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.31
  • Beta release target (x.y): 1.33-1.34
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-4639: adding OCI VolumeSource #4642
  • Code (k/k) update PR(s):
    • [KEP-4639] Add OCI VolumeSource CRI API kubernetes#125659
      • [KEP-4639] Update CRI API and workflow #4751
    • [KEP-4639] Add ImageVolumeSource API kubernetes#125660
    • [KEP-4639] Add ImageVolumeSource implementation kubernetes#125663
    • Nice to have:
      • [KEP-4639] Mention that fsGroupChangePolicy has no effect kubernetes#126281
      • Fix runtime panic in imagevolume CanSupport method kubernetes#126323
      • [KEP-4639] Add ImageVolumeSource node e2e tests kubernetes#126220
  • Out of tree update PR(s):
    • Add OCI Volume Source support to crictl [create|run] --with-pull kubernetes-sigs/cri-tools#1464
    • Add OCI/Image Volume Source support cri-o/cri-o#8317
    • Make ImageVolume garbage collection work cri-o/cri-o#8408
    • CRI-O: add pull-kubernetes-node-crio-cgrpv2-imagevolume-e2e test job test-infra#33071
    • Fix imagevolume test focus test-infra#33088
  • Docs (k/website) update PR(s):
    • Document OCI volume sources / KEP-4639 website#46946
    • Blog post about OCI volume sources / KEP-4639 website#46960
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-4639: update to most recent implementation state and graduate to beta #4897
    • 4639: bump to 1.34 and document noexec drop #5417
    • [KEP-4639] Image Volume: remove noexec option #5354
    • 4639: bump to 1.34 and document noexec drop #5417 retargeting beta in v1.34, dropped noexec requirement
  • Code (k/k) update PR(s):
    • [KEP-4639] Graduate image volume sources to beta kubernetes#130135
    • Enable ImageVolume tests for pull-kubernetes-node-e2e-containerd-alpha-features test-infra#34398
    • Optional: [KEP-4639] Image volume subpath e2e kubernetes#130681
  • Docs (k/website) update(s):
    • [KEP-4639] Graduate image volume source to beta website#49936
    • [KEP-4639] Feature blog 1.33: Image volumes graduate to beta website#49984
  • Out of tree update PR(s):
    • Add image volume subpath support cri-o/cri-o#9050
    • Update cri-api to latest commit kubernetes-sigs/cri-tools#1793
    • Bump CRI-O cgroups v2 jobs to bdcf72 test-infra#34547
    • Fix CNI setup for CRI-O test-infra#34549
• Stable
  • KEP (k/enhancements) update PR(s): [KEP-4639] Graduate image volumes to GA #5450
  • Code (k/k) update PR(s):
  • Docs (k/website) update(s):
• Follow-ups:
  • Read-write volumes as outlined in: KEP-4639: Allow writeable, container isolated volume content #5288

[sallyom]

I've had informal discussions about this - there's enough interest IMO to open a KEP & I will present this issue at upcoming sig-node, sig-storage mtgs with a KEP draft

/sig node
/sig storage

[xing-yang]

Can you use the Volume Populator? It allows you to create a PVC from an extenal data source. https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1495-volume-populators

[saschagrunert]

Happy to support here from a SIG node perspective.

cc @kubernetes/sig-node-proposals

[mikebrow]

+1 happy to help from the SIG-Node/CRI and OCI image/distribution spec perspectives..

[SergeyKanzhelev]

/label lead-opted-in
/milestone v1.31

as discussed at SIG Node meeting this week, we will try and see if this can make it to 1.31

[SergeyKanzhelev]

/stage alpha